5d7305e6416f610891e7682ba88b5d0798e3fe830429ea2ef7a3af3936ee785c

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 16:45

Target

358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe
Size

101KB
MD5

358da6007662cd6cb36b44f473fea764
SHA1

e8cf6afbf7b0a86ddab588e45179713e1b35b328
SHA256

5d7305e6416f610891e7682ba88b5d0798e3fe830429ea2ef7a3af3936ee785c
SHA512

416f215fade4dc43052032109a43e48df49be84d164b204c84f3d34df1867c5c3c51662a961f9ebeb07410109fce0e07fbe36eab47f54865ed0227e43521da64
SSDEEP

3072:fDcLAo50eUOZyiO8hGZUyq/CwU5jXJToY:rowl9ZUENjp

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4128-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4128	358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 644	4128	358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe	83
PID 4128 wrote to memory of 644	4128	358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe	83
PID 4128 wrote to memory of 644	4128	358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe	83
PID 4128 wrote to memory of 644	4128	358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe	83
PID 4128 wrote to memory of 644	4128	358da6007662cd6cb36b44f473fea764_JaffaCakes118.exe	83

memory/4128-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-1-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4128-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4128-3-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/4128-4-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download